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SUMMARY 


A redundant three-axis analog control system was designed and developed to 
back up a digital fly -by-wire control system for an F-8C airplane. Forty -two 
flights, involving 58 hours of flight time, were flown by six pilots. The mechaniza- 
tion and operational experience with the backup control system , the problems 
involved in synchronizing it with the primary system , and the reliability of the 
system are discussed . 


The backup control system was dissimilar to the primary system , and it pro- 
vided satisfactory handling through the flight envelope evaluated . Limited flight 
tests of a variety of control tasks showed that control was also satisfactory when the 
backup control system was controlled by a minimum-displacement (force) side stick . 

The operational reliability of the F-8 digital fly-by-wire control system was 
satisfactory , with no unintentional downmodes to the backup control system in flight . 
The ground and flight reliability of the system's components is discussed. 


INTRODUCTION 


A control system consisting of a primary digital fly-by-wire system and a dis- 
similar triplex analog backup system was flight tested in an F-8C airplane by the 
NASA Flight Research Center . The mechanical linkages of the original F-8C control 
system were removed except for cockpit stick and pedal centering and feel . A 
single channel digital computer , the associated electronics , a power-generating 
system , and electrohydraulic secondary actuators made up the primary control 
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system . A triplex backup control system provided the redundancy required for 
manned flight and gave the total system two -failur e-op er ate reliability . 

The main components of the backup control system were the sensors, the elec- 
tronics, and the secondary actuators. The system was analog for signal processing, 
had no feedback for stability augmentation , and was designed to provide emergency 
return-home capability with airplane handling qualities equal to those of the basic 
F-8C airplane. The F-8C airplane can be flown through most of its flight envelope 
without augmentation . 

This paper describes the backup control system and its integration with the 
primary control system , which is described in detail in paper 2 . The mechanization 
of and operational experience with the primary and backup control systems are 
discussed . Some aspects of the primary and backup control system design were 
unique; however , many of the design features would apply to fly-by-wire control 
systems in active control aircraft. The reliability of the total system during the 
program is described. 

A limited flight test evaluation of the backup control system was conducted using 
a minimum-displacement (force) side stick controller for pitch and roll control. 
These evaluations represent most of the maneuvering experience with the backup 
control system. 


DESIGN FEATURES 


The backup control system was designed to provide redundancy for the F-8 
digital fly-by-wire control system . It was a triplex analog fly-by-wire control- 
stick-to-control-surface system in which the electronic trim, sensor and electronics 
equalization, primary control system synchronization, and servo and electronics 
monitoring were independent of the primary control system . The system incorpo- 
rated several innovations that are common in modern electronics equipment but not 
as common in airplane control system hardware . These design features are 
described in the following sections . 

A functional block diagram of the F-8 digital fly-by-wire control system is pre- 
sented in figure 1 . The upper portion of the figure is the primary control system , 
and the lower portion is the backup control system . The secondary actuators are 
shared between the primary and backup systems , and the primary control elec- 
tronics provide the interface between the digital-to-analog converters of the primary 
system . The secondary actuators and the synchronization between the primary and 
backup systems are also discussed in this paper . 


Triplex Channels 

The backup control system consisted of three identical computing channels , 
one for each airplane control axis. The system provided an interface between the 
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triplex control stick and pedal position sensors and the triplex servovalves . In 
addition , the three backup control system channels , including the sensors , elec- 
tronics , and servos , were powered by three isolated power busses that were 
connected to a common power source. 

The servo commands , which consisted of stick and pedal commands that were 
summed with the trim and equalization signals , were processed by voters in each 
channel to insure that the three backup channels tracked . The voter selected the 
middle value of the three channel commands to drive the control valve in each 
channel. For certain types of failures in the voter , actuator , or servo electronics , 
the failed channel would be detected and the servovalve associated with the failed 
channel would be disengaged. Therefore, the backup control system was opera- 
tional after one or more failures . 


Synchronization 

An integrator in each axis of the three backup control system channels provided 
electronic trim , equalization , and synchronization . When a primary channel was 
engaged, the backup control system servo commands were synchronized with the 
primary servo commands with these integrators . These inputs to the backup con- 
trol system voters tracked the primary channel servo commands , even though 
variations in control sensor outputs and in intersystem control laws existed. Con- 
tinuous synchronization of the backup with the primary control system was neces- 
sary to minimize control surface transients during the switchover from the primary 
to the backup control system. Switchover occurred if there was a failure in the 
primary system or if disengagement was commanded by the pilot . The synchroniza- 
tion network had a bandwidth of approximately 2 .5 hertz . 


Equalization and Trim 

When the backup control system was engaged, the integrators performed the 
backup control system trim and equalization function. Trim was accomplished by 
applying a fixed reference to the integrator , changing trim at a fixed rate . The 
integrator output was then summed with the control stick or pedal position inputs 
to form the total surface command. Since the trim inputs, sensor position inputs, 
and electronic gains were not necessarily the same in each backup control sys- 
tem channel, equalization was included to reduce errors between channels. Limited 
equalization, combined with the voters, produced essentially identical channel 
servo commands to the three backup control system servovalves and minimized the 
force fight between the secondary actuator pistons . 

The trim and equalization functions required a low or zero drift integrator . 

The backup control system integrator design , which was classified as having zero 
drift , used digital techniques to accomplish the zero drift or memory function and 
analog techniques for the integration function . 
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Backup Control System Monitoring 


Electronic and servo signals were monitored at two points within the backup 
control system . The channel voter output was compared with the voter input . If 
the signal difference was greater than the set threshold , the monitor was latched and 
the electronic channel was reported failed . 

The other monitoring point was the backup control system servos . Backup con- 
trol system servo monitoring was accomplished by cross-channel comparison of the 
differential pressure signals from each of the three servovalves. This detected ex- 
cessive force fights within the backup control system servos. A preset difference 
in two of the three differential pressure signals resulted in latching the common 
servo monitor, disengaging the failed servo, and reporting the failure to the pilot. 
When a failure was detected and the failed servo disengaged , the resulting surface 
transient was minimized by the operating characteristics of the force-summed 
actuator . 


Self- Test Procedure 

Preflight testing was accomplished by an automatic self-test procedure that 
provided a pseudo-end-to-end testing of the system. The self -test involved the in- 
troduction of a logic-controlled stimulus and the disabling of circuit functions and 
used in-flight monitors to indicate the response . The use of the in-flight monitors 
as the self -test feedback elements served to check the channel signal paths and the 
operation of the in-flight monitors . This resulted in a "bang-bang" type of test with 
no indication of system degradation. 

A block diagram of the self-test unit is shown in figure 2 . The power for the 
self -test was routed to the computing electronic assemblies only after the self-test 
power switch was closed and the self-test start switch was depressed . A counter 
started to count and addressed the read-only memory , which was preprogramed for 
each particular test to activate certain stimuli and disable certain circuits in the 
electronic assemblies. The test results were compared with the predicted results , 
which were stored in the read-only memories in the diagnostic analysis circuitry . 
The self-test automatically stepped to the next test if the test results were as pre- 
dicted . This procedure was repeated with different combinations of stimuli and dis- 
abling circuits active until the test was complete and a GO signal was reported in 
each airplane control axis . 

If the test results from the electronic assemblies were not as predicted , the 
test sequence was stopped and a diagnostic routine was initiated . The diagnostic 
analysis circuitry analyzed the test results with respect to the predicted results to 
determine where the failure occurred . The diagnosis was indicated on the self-test 
diagnostic readout . 


Status Engage Panel 

The status engage panel was in the left cockpit console . It housed all the 
servo engage switches and servo status lights and indicated the status of the 
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backup control system electronics . The panel also contained the self-test program , 
power switch , and diagnostic readout to indicate a failed self-test condition or satis- 
factory completion of the self-test . The servo switches were three -position positive- 
action switches labeled Auto-Off and Manual . Even though five secondary actuators 
were utilized for the three control system axes , only three switches and servo status 
lights were used for the three primary control channels , whereas individual channel 
switches and status lights were mechanized for each backup control valve . The 
lights indicated when the various comparator networks had exceeded preset values. 
The light was also a reset switch that sent a reset pulse to its comparator . The 
servo status lights for backup servo systems 2, 3, and 4 lit up after any two common 
comparators tripped. That is, the left pitch 2-3 comparator and the left pitch 4-2 
comparator lit the left pitch number 2 light when both comparators tripped. The logic 
for the primary control system pitch servos was that if either the left or the right 
pitch channel indicated failure, the number 1 pitch status light lit, and control was 
switched from the primary to the backup control system . The servo system logic 
was designed to provide a manual override capability for any channel per actuator 
regardless of the remaining servo system switch positions. 


SYSTEM COMPONENTS 


The approximate locations of the control system components in the F-8 digital 
fly-by -wire test airplane are shown in figure 3 . As might be expected , using the 
F-8C airplane as a test-bed resulted in some design problems that were unique to 
the F-8C configuration, A major problem was the requirement for different control 
gearing for the wing-up (approach and landing) and wing-down (cruise) positions . 
A pair of dual wing potentiometers was mounted to provide an electrical signal pro- 
portional to wing position to droop the ailerons for flaps and to provide automatic 
trim of the horizontal tail . Other system components that provided control , signal 
conditioning , and actuation are described below . 


Control 

Stick and pedal transducers. — Two transducers that each contained triplex 
redundant linear variable differential transformers (LVDT's) were connected to the 
existing F-8C flight control linkage to provide electrical signals as functions of the 
pilot's stick and rudder commands. One transducer was provided for the primary 
control system , and one was provided for the backup control system for each air- 
plane axis of control. The pitch transducers were on the right and the roll trans- 
ducers were on the left side of the airplane underneath the primary flight pallet. 
Because of rudder cable stretch, the two rudder transducers were installed in the 
base of the vertical tail . 

Each transducer assembly contained isolated sensors for excitation and signal 
output to drive as many as three separate control paths. All the transducers were 
linear , except for the pitch transducers for the backup control system , and all had 
an electrical stroke of ±1.5 centimeters. The pitch transducer for the backup control 
system transducer had a special winding to provide parabolic stick shaping. 
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Stick and pedal gearing. — An attempt was made to duplicate the control author- 
ity and gearing of the original F-8C airplane in the F-8 digital fly-by-wire airplane . 
The final gearings are shown in figures 4(a) to 4(e) for the pitch, roll, and yaw 
axes . 

The data presented in figure 4(a) indicate that there was reasonable agreement 
between the pitch stick gearing of the fly-by-wire airplane and that of a conven- 
tional F-8C airplane. Only the wing-down data are presented for zero trim command. 
With the wing in the up position , the horizontal stabilizer surface was biased 5° from 
the wing-down position, and the zero stick position corresponded to zero surface 
position . 

Figure 4(b) shows the left aileron position as a function of lateral stick position 
for a wing-down and a wing-up configuration with zero trim command . The gra- 
dients are nearly the same for all backup control system commands except for the 
wing-up right stick command , where the gradient is higher than in the conventional 
F-8C airplane. The fly-by-wire gradients were symmetrical for both wing positions , 
whereas the wing-up gradient was not symmetrical (differential aileron) for the con- 
ventional F-8C airplane . The aileron did not move down as far as it moved up for a 
given stick command . 


Figure 4(c) shows rudder displacement as a function of pedal force. Gradients 
are shown for the wing-up and the wing-down configurations . The higher gradient 
was used with the wing-down configuration. The pedal forces were provided by the 
existing F-8C mechanism. The gradients show good agreement for both wing posi- 
tions . The backup control system deadband was slightly larger . 

Side stick. — The side stick sensor flight tested during the program was a two- 
axis, four-channel, minimum-displacement transducer. The principal of operation 
for the transducer was that an applied force at the stick grip caused a flexure- 
supported tube assembly to move quadruplex LVDT’s that generated a voltage pro- 
portional to the applied force. The side stick transducer was recessed in the right 
cockpit console to allow the pilot to sit comfortably in the seat with his arm in a 
natural position . 

Side stick gradients. — The side stick gradients flight tested are shown in fig- 
ures 5(a) and 5(b) for the pitch and roll axes, respectively. Figure 5(a) shows 
the pitch stick force as a function of elevator surface position for both wing posi- 
tions . The circuit mechanization consisted of a deadband , a low gradient , and a 
high gradient for both a pull and a push force. The variable high gradient was 
mechanized to function only with the wing down , and it was controlled by a switch 
in the cockpit. In figures 5(a) and 5(b) , switch positions increase with increasing 
stick gradient . The side stick authority was always less than the center stick 
authority. 


Electronics 

Backup control system. — Three identical backup control system electronics 
boxes were the heart of the backup control system . Each box contained all the 
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signal processing , engage logic , monitoring , and de power necessary for a single 
backup control system channel in the pitch, roll, and yaw axes. A block diagram 
of a single channel in the roll axis (channel 3) is shown in figure 6 . Except for 
scaling , trim rate , and the gearing change with wing position , the network for the 
pitch axis was basically the same . The yaw axis differed in scaling and trim rate , 
and a limiter was added just after the voter . The voter output drove only one 
actuator network . 

Figure 6 shows one electrical comparator across the voter and a single compara- 
tor across each backup valve . In total , there were eight comparators per backup 
control electronics box . The trip level of the electrical comparators was set at 
3 . 0 volts , which was approximately one-third the maximum voltage for each axis . 

This corresponds to a stick displacement of approximately 2 . 5 centimeters for roll 
and 5 centimeters for pitch. The differential pressure comparators were set to trip 
at 2.4 volts, which represents a differential pressure error of 8273 kN/m 2 . 

Primary control electronics . — The primary control system electronics box con- 
tained the signal interface between the computer's digital-to-analog converter outputs 
and each secondary actuator for the airplane's pitch , roll, and yaw axes . A simpli- 
fied block diagram of a typical primary signal circuit is shown in figure 7. For each 
control axis, there were two identical signal paths, the active and monitor channels, 
from the computer to the control valves of the respective secondary actuator . The 
primary control electronics box contained two 5-hertz second-order smoothing 
filters in each of the three axes. Follow-up signals from the secondary actuator 
were biased with the wing position voltage for the pitch and roll actuators. The 
signal was then divided for summing and sent directly to the monitor servo amplifier 
or quadruplex voter and processed with the three comparable signals from the back- 
up control system . In conjunction with the hydrologic comparator , this provided 
hard-over protection from open servo follow-up signals. 

The primary control electronics box also contained engage logic , monitoring , 
and the dc power supply for the box and the primary secondary actuators . A 
separate return comparator was used to monitor the difference between comparable 
points in each axis of the primary and backup control systems. When the error was 
greater than 3°, 4°, and 3° for the elevator, aileron, and rudder, respectively, the 
primary control system could not be engaged . However , the backup control system 
could always be selected . 

Side stick electronics . — The installation of a side stick required additional 
electronics that could not be readily added to the backup control electronics boxes. 
Therefore, the additional electronic networks needed to provide demodulation, 
deadband, shaping, and gradient (fig. 8) were mechanized to interface between the 
side stick transducer and the backup control electronics boxes. The triplex elec- 
tronics concept was maintained from sensor output to the appropriate channel sum 
points in the backup control electronics boxes . 


Secondary Actuators 

The secondary actuator (fig . 9) was a four-channel electrohydraulic actuator 
designed to convert electrical signals to surface motion and to have two-fail-operate 
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capability . There were five secondary actuators: two for roll , two for pitch , and 
one for yaw . The mechanization of the secondary actuator was an active/ standby 
configuration which consisted of two valves in the active configuration and three 
valves in the standby configuration . The secondary actuator was designed to be 
controlled by any of the four electrohydraulic control channels . Each primary 
channel commanded one active valve to position the actuator; the second valve, in 
conjunction with the hydrologic failure detection network , was used for self' 
monitoring . The actuator standby or backup channels commanded by the backup 
control system consisted of three force-summed channels with electronic failure 
detection . 

Two-stage flapper nozzle servovalves were used for the primary system active 
and monitor valves . During normal operation , these valves received separate 
commands, and the active valve positioned the actuator ram as required. The fail- 
ure detection for the primary control system was provided by a hydraulic comparator 
network. A comparator spool was balanced between the force exerted by two 
springs and the output pressures from the active and monitor spools. If a pressure 
difference beyond a predetermined threshold existed, motion of the comparator 
spool dumped the supply pressure to the return line, which caused the primary 
engage valve to reposition and block the commands from the active servovalve . 

Errors that could cause the hydrologic comparator to trip were measured in terms of 
either single control surface deflection or commanded current. These were 4°, 4°, 
and 1.5° for the elevator, aileron, and rudder control surfaces, respectively, or 
one-half the maximum valve current . 

A dual pressure switch was installed in the primary hydraulic circuit of each 
secondary actuator to sense minimum pressure. The switch caused the primary servo 
system to disengage at 4137 kN/m 2 , and a pressure of at least 5516 kN/m 2 was re- 
quired for manual reengagement, When the primary channel tripped, the pressure 
switch opened , which caused the engage logic to automatically energize the three 
solenoids in the backup control system and to transfer control to the three single- 
stage jet pipe servovalves (servo systems 2,3, and 4) . 

The backup system servos were monitored by differential pressure transducers 
that were installed across the output legs of each jet pipe servovalve. Each differen- 
tial pressure signal was compared with the other two differential pressure signals 
for each actuator . The comparison was made in the backup control electronics boxes . 

The secondary actuators were modular in construction and were designed around 
three tandem pistons on a common shaft. The primary channel and one backup con- 
trol system channel shared one of the piston networks , and the remaining pistons 
were controlled by the other two backup systems. Each secondary actuator was 
supplied by two separate hydraulic systems. Figure 9 shows the secondary actuator 
mechanization in the primary configuration . 

The figure shows that the valve outputs of backup channels 2 and 4 were blocked 
by separate hydraulic engage valves and that the cylinders bypassed fluid as the ram 
moved. Backup channel 3 was blocked by an engage valve with a slightly different 
design . 

The servo position loop was closed electrically for each channel in the elec- 
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tronics boxes . The electrical signal utilized for the servo ram position came from 
the quadruplex redundant LVDT in each servo actuator shaft. The stroke of all the 
secondary actuators was 5 centimeters , and by utilizing the necessary mechanical 
linkage, the desired control surface rotation was obtained for all five surfaces. 

Response characteristics . — Ground test data were taken for each actuator with 
different valve combinations. The performance of each secondary actuator was a 
function of the engaged servovalves . The primary valves had much higher re- 
sponse than the valves used in the backup servo systems (systems 2, 3, 4) , but 
because of hardware problems (ref. 1) the primary servo amplifier gain was 
lowered . 

A typical frequency response curve of the elevator secondary actuator with the 
primary servovalve in control is shown in figure 10. The figure compares the flight 
tested servo amplifier gain , 5 milliamperes per volt , with the designed servo ampli- 
fier gain of 22 milliamperes per volt. Even though the pitch servo bandwidth flight 
tested was 6 hertz , the addition of a second-order filter reduced the effective servo 
bandwidth to 2 .5 hertz . The total bandwidth of the filter , secondary actuator , and 
elevator power actuator was 1 .5 hertz for an elevator surface amplitude of 1° peak 
to peak , normalized at 0 . 5 hertz , 

The frequency response of the same pitch secondary actuator when controlled by 
the backup control system valves is shown in figure 11. Data are compared for two 
valve drive configurations . One data set was obtained with a single backup control 
system channel valve in control of the secondary actuator . The other data set was 
obtained with all three backup valves in control . The single backup control system 
channel bandwidth was 7 hertz , and the bandwidth of the three backup control sys- 
tem channels was 13 hertz. All three backup control system channels per airplane 
control axis had the same servo loop gain, which indicates that the performance in- 
crease was a result of the force summing of the secondary actuator pistons . 

Hysteresis . — Hysteresis measurements were also taken for each secondary ac- 
tuator for the various valve drive combinations . The data were obtained by driving 
the appropriate servovalves with a signal generator set at 0.01 hertz. For example, 
the hysteresis of the elevator secondary actuator for the primary channel (fig. 10) 
was 0.44°. By increasing the loop gain, this value could be reduced to 0.13°. The 
equivalent measurements for the two backup control system conditions presented in 
figure 11 are 1.10° for the single-channel drive configuration and 0.47° for the 
three-channel drive configuration . 

A minor item of interest pertaining to the secondary actuators was observed dur- 
ing single channel operation with the backup control system . Even though the elec- 
trical commands to each paired surface, such as the aileron and elevator, were the 
same, the control surfaces did not track each other during large control cycles. 

This was caused by the component offset characteristics in the servo loop as well as 
by the seal friction of the respective actuator channel . A given servo system took 
more current to retract the ram for the left control surface than the right control 
surface and less current to extend the left than the right . From outside the airplane 
the control surfaces did not appear to track. This was most noticeable with the ele- 
vator surfaces. This condition existed with every actuator, and there was no way to 
adjust the offset. When additional servo systems were engaged, the condition was 
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minimized and the agreement between the deflections of the paired surfaces was good . 

The condition was not apparent with the primary control system engaged 
because of the higher bandwidth servovalve and pressure gain. 


Electrical Power 

The electrical power for the operation of the F-8C aircraft was supplied by the 
main generator power package . This unit was comprised of ac and dc brushless 
generators that were mounted on a common shaft, regulators for the generators, an 
air turbine motor, and the necessary reduction gears. Energy for the turbine was 
supplied by high pressure bleed air from the engine. The ac generator was rated at 
12 kilovolt amperes at 115 volts and 400 hertz. The dc capacity was 68 amperes at 
30 volts. An emergency power package supplied backup electrical power as well as 
a hydraulic pump driven from a ram air turbine . The capacity of this unit was 
30 amperes of dc and 4.2 kilovolt amperes of 400-hertz power. Figure 12 shows the 
power distribution system of the F-8 digital fly-by-wire airplane. 

The power requirements of the fly-by-wire system were determined by the char- 
acteristics of the Apollo equipment . This equipment limited the ripple , spike , and 
surge voltages on the nominal 28-volt bus to a maximum of 32.5 volts and a minimum 
of 24.5 volts , with a peak current demand of 60 amperes. These requirements , in 
addition to a requirement for an estimated 30 amperes for the backup control system , 
made it necessary to install an additional power source in the airplane. Therefore, 
a direct-drive, 100-ampere, 32-volt dc flight control system generator was mounted 
in the nose cone of the engine . The voltage regulator was set to provide 28-volt 
power at the primary (number 1) bus . To give the additional protection required by 
the Apollo equipment, zener diodes and a 55,000-microfarad capacitor were placed 
on the number 1 bus . Flight control system power was controlled from the cockpit 
through normally closed power relay contacts . A warning indicator informed the 
pilot of loss of generator power . 

To provide the necessary redundancy , 28-volt power was divided into four sep- 
arate busses by isolation diodes and circuit breakers (fig. 12) . Each bus , one for the 
primary system and one each for the triply redundant backup control system , had a 
24-volt, 11-ampere-hour nickel cadmium battery as an alternate source of power. 
Backup control system batteries were always on the line , and they were kept fully 
charged by a constant trickle charge. They could provide power for a minimum of 
1 hour after the loss of the flight control system generator . For additional protection , 
it was made possible for the pilot to place the main dc generator on the backup control 
system busses with normal loads reduced. To assist the pilot in monitoring the con- 
dition of the backup control system battery , a battery capacity meter was installed in 
the cockpit. This device measured current flowing into or out of the battery in 
terms of percent of full charge. It was not intended for the number 1 battery to 
supply the primary system with power for more than a few minutes . Its sole purpose 
was to aid in the stabilization of the bus voltage and to allow operation during tem- 
porary power interrupts like those that occurred during bus switching. For the pro- 
tection of the number 1 battery, a circuit was installed to remove the battery from the 
bus whenever voltage dropped below 20 volts. 
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OPERATIONAL EXPERIENCE 


The first operational experience with the F-8 digital fly-by-wire control system 
was acquired during the integration and checkout of control system components in an 
iron bird simulator (paper 2) . The simulator was used to fine tune the control sys- 
tem to give it the necessary authority , trim rates, servo loop gains, and comparator 
trip levels. Before the first flight, the entire flight control system was subjected to 
an extensive ground test program that lasted 7 months . During this period , two 
major hardware changes were made. Because of the nonlinear characteristics of the 
Apollo hardware (ref. 1) unacceptable noise was transmitted to the secondary 
actuators. A second-order filter network was installed to smooth the primary system 
electronics. The backup control system integrators were changed to digital from 
analog because of drift . 


Backup Control System Flight Evaluation 

Before the first flight, the backup control system was tailored. to the primary 
channel gearing and trim rates in each airplane axis . The flight controllability of 
the primary control system and the backup control system was evaluated on the sim- 
ulator . Since the sole purpose of the backup control system was to provide an emer- 
gency return-home capability if the primary system became inoperative , the flight 
testing of the backup system was minimal . The testing did insure that the backup 
system would provide acceptable controllability, and at least once per flight the F-8 
digital fly-by-wire control system was downmoded to the backup control system to 
perform an inertial measurement unit alinement. This was done in level flight. 

Center stick . — The piloting tasks used to evaluate the backup control system 
with the center stick paralleled those used to evaluate the primary control system in 
the direct mode. The evaluation maneuvers included routine flying while evaluating 
gross and fine control maneuvers, formation flight, and gunsight tracking. The 
low-speed evaluations included ground control approaches. The first flight evalua- 
tion took place at speeds between 275 and 300 knots indicated airspeed with routine 
flying maneuvers . The pilot comments indicated that roll response was adequate 
and pitch control was good at these flight conditions . The airplane also exhibited 
satisfactory handling qualities and control power in the landing approach . During 
subsequent flights , the airplane seemed sensitive in the roll axis , and in a more 
demanding control task , that is , formation flight , the pilot indicated that airplane 
roll response became too oscillatory (paper 7) . He assigned the task a pilot rating 
of 6 on the Cooper-Harper scale (ref. 2) . The lateral sensitivity problem was 
reduced by adding electrical deadband to the roll stick command signals . The 
modification yielded the roll gearing shown in figure 4(b) . Even though the backup 
control system roll gearing was approximately the same as that in a conventional 
F-8C airplane, some pilots commented that the airplane rolled a little faster than 
they liked for a given stick displacement at 300 knots indicated airspeed. However, 
they felt that the roll response was not overly sensitive. A viscous damper was 
added to the aileron stick linkage to improve the dynamic stick characteristics for 
both the primary and the backup control systems . 
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For the first eight flights of the F-8 digital fly-by-wire airplane , a linear trans- 
ducer was used in the pitch axis of the backup control system . As flight speeds 
increased, a longitudinal sensitivity problem was observed by the pilot in both the 
primary and the backup control systems . This problem was solved by reducing the 
slope of the curve around zero but maintaining the previous control authority . Be- 
cause of the inflexibility of the design of the backup control electronics boxes , non- 
linear characteristics were obtained by having a stick transducer manufactured that 
was similar to the original but gave the desired curve shape . The pitch modification 
and appropriate scaling change in the backup control electronics boxes resulted in 
the backup control system pitch gearing presented in figure 4(a) . Subsequent flight 
evaluations indicated that control was satisfactory in cruise as well as in the landing 
approach. In normal flight, the airplane's control characteristics with the backup 
control system were similar to those in the primary control system's direct (unaug- 
mented) mode . For maneuvers that required large changes in pitch , however , such 
as gunsight tracking during windup turns , the pilots preferred the backup control 
system to the primary control system because of its smoother pitch response . The 
characteristics of the primary channel were poorer because of stick quantization 
(paper 6) . 

The trim switches for the backup control system pitch and roll axes were on the 
left cockpit console just forward of the throttle control. During the evaluation of 
the backup control system , it became apparent that the location of the trim switches 
was undesirable. One pilot rating was at least one number higher (poorer) because 
of the additional workload due to this location . Beginning with the side stick evalua- 
tion phase of the flight testing , the backup trim was activated from the conventional 
center stick trim switch. 

Side stick. — The side stick was evaluated primarily by two pilots during six 
flights . Six other flights were flown by four pilots who were evaluating other fea- 
tures of the control system . Although the side stick gradients were not optimized , 
the side stick controller was considered to be of interest in the overall control sys- 
tem evaluation. Side stick evaluation tasks included formation flight, gunsight 
tracking, mild aerobatics, ground control approaches, landing, and takeoff. Since 
takeoff was considered the most uncertain phase of flight , it was performed only 
after side stick control was evaluated in a high pilot gain task during up and away 
flight. During the 12 evaluation flights, three takeoffs and seven landings utilizing 
the side stick controller were made. 

The stick gradients selected for flight test were based upon the six-degree-of- 
freedom simulation results obtained with the iron bird simulator . The stick-to- 
surface gradients were selectable , as shown in figures 5(a) and 5(b) . The wing- 
down gradients selected by most of the pilots were position 1 in pitch and position 3 
in roll. The roll gradients were not changed during any of the flights, whereas a 
slight change was made in the pitch axis . The original transition , or knee , of the 
curve between the low and high gradients was at approximately 36 newtons , and 
this value was increased to approximately 57 newtons for the last three flights. 

All the pilots adapted easily to the side stick controller in flight after practice 
on the simulator . They all 'commented on the sensitivity of the pitch axis , particu- 
larly in high pilot gain tasks like formation flight. The center stick was also some- 
what sensitive, but the excursions were lower in amplitude. Some of the pilots 
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tended to fly both pitch and roll with a pulsing type of input , Most pilots tended to 
hold a nose-up stick force during the various maneuvers. The value they used was 
approximately 23 newtons , which was outside the stick deadband . One of the six 
pilots noted arm fatigue after a flight in which he evaluated side stick control. Sev- 
eral pilots rated the formation flight control task 3 to 5 . 

As discussed in paper 7, gunsight tracking was typified by good to excellent 
control over the lateral-directional axis and continuous pitch oscillations caused by 
pitch commands that were too abrupt . Crosstalk was absent in the tracking task . 

A comparison between a side stick-controlled and a center stick-controlled tracking 
run showed a higher frequency output from the force side stick , indicating a higher 
pilot workload . 

The wing-up stick force gradients were evaluated in the power approach con- 
figuration for pitch out maneuvers and ground control approach patterns . Many of 
the approaches were flown in light turbulence, which seemed to have little adverse 
effect on control , Pitch and roll control was adequate , and pilot ratings ranged 
from 2 to 4 for the landing approach task . 


Synchronization Performanc e 

An important design requirement for a backup control system is that it track 
the primary system closely to minimize the switching transients. Therefore, syn- 
chronization networks were used to keep the systems synchronized. During every 
flight , the primary system was downmoded to the backup control system at least 
once to aline the inertial measurement unit in level flight . 

Thus , downmoding to the backup control system was checked approximately 
40 times. The surface transients were always less than 1°. The transients observed 
during these downmodes were caused primarily by the differences in null between 
the primary and the three backup servovalves of each secondary actuator. Overall, 
the system's static performance was good. 

Simulation studies on the iron bird simulator showed that the synchronization 
network bandwidth of 2 . 5 hertz provided satisfactory backup control system track- 
ing of the primary system for all except abrupt stick commands. The simulator 
studies also indicated that the synchronization/ trim network characteristics could 
produce a large out-of-trim condition during a dynamic downmode if stick or pedal 
commands were being applied . The corrective action was to trim out the stick or 
pedal signal present at the time of the downmode. 


Trim 

The backup control system was mechanized with a digital integrator for trimming 
the backup control system and for synchronizing the backup control system with the 
engaged primary system. Since the control systems had to be synchronized over the 
full authority of the control surfaces , the integrator had to be scaled for full control 
authority. This resulted in an integrator resolution of 0.18°, 0.30°, and 0.20° for 
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elevator, aileron, and rudder, respectively. Trimming a control surface became 
a stepping operation and was not precise. 


Hydraulics 

The conventional F-8G hydraulic systems were not changed except for the addi- 
tion of the F-8 digital fly -by-wire secondary actuators. Two hydraulic pumps each 
delivered a maximum of 45 liters per minute at a nominal pressure of 20,684 kN/m 2 . 
This capacity was marginal during two operations . At idle power , the hydraulic 
flow was inadequate to support preflight self-tests. A power setting of 80 percent 
proved to be satisfactory and was used for airplane ground checks. The self-tests 
were designed to operate in all three axes or one axis at a time. The latter proce- 
dure was used most often, although the three-axis tests were completed in approxi- 
mately 4 minutes . During landing at idle power , high control surface activity 
caused the hydraulic pressure to drop, which caused the secondary actuator pres- 
sure switches to downmode the F-8 digital fly-by-wire system from the primary to 
the backup control system . This occurred during two landing rollouts , but no con- 
trol system transients were observed by the pilot . 


CONTROL SYSTEM RELIABILITY 


The primary and backup control systems operated approximately 2500 hours 
during the fly-by-wire program, including both aircraft and iron bird operation, 
without any major problems . Six evaluation pilots flew the F-8 digital fly-by-wire 
airplane 42 times for a total flight time of 58 hours. Because of its length, the pro- 
gram was not expected to establish a level of confidence in fly -by-wire control sys- 
tems , but it did constitute a first step toward developing such confidence. From 
the first flight , the airplane was flown with a control system that had no mechanical 
backup or reversion capability , During the evaluation flights , there were no sys- 
tem failures that could be attributed to the fly-by-wire aspect of the digital flight 
control system . There were no electronic failures in flight in either the digital 
primary system or the backup control system . There was one hydraulic line failure 
that reduced the total system redundancy level from four channels to two channels , 
but flight was no more critical than it would have been if a similar failure had 
occurred in a standard F-8C airplane. This is discussed in more detail below . 

In addition to the reliability of the total system , it is important to discuss the 
reliability of the elements of the system . Table 1 summarizes the discrepancies that 
occurred in the F-8 digital fly-by-wire control system. The table includes the dis- 
crepancies experienced with the iron bird simulator as well as those experienced 
with the F-8 digital fly-by-wire airplane . Discrepancies observed during ground 
operation, preflight testing, and in flight are listed by major system component. A 
discrepancy was any system operation that appeared to be abnormal. Some were 
minor transient effects that did not affect the system's performance or reliability. 
The number of discrepancies that required a repair or replacement action is indi- 
cated . Even if no repair wa,s required , extensive tests were made to insure that the 
component in question performed as designed . 
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The discrepancies listed for the computer and related hardware, which are dis- 
cussed in paper 6 , are listed here to present an overview of the operational prob- 
lems encountered during the program A coolant system designed specifically for the 
Apollo system used on the F-8 digital fly-by-wire airplane caused one flight to be 
canceled before takeoff and one flight to be terminated early. The coolant system 
problem was attributed to lines that were frozen and did not permit the coolant to 
flow through the cold plates. When this occurred in flight, the coolant system was 
being monitored and the flight was terminated before it affected the control system . 
The pilot continued to fly on the digital primary system , and four channel redun- 
dancy was retained through landing. This problem was unique to the Apollo equip- 
ment and therefore would not be expected in production fly-by-wire systems. 

Three power turn-on problems were observed, two with the backup electronics 
and one with the primary electronics. On one occasion , measurements indicated that 
the voltage supply for the primary electronics was not present . Recycling the power 
switch brought the power supply on line , and during subsequent testing the problem 
did not reappear . Laboratory testing did not reveal the cause of the problem , but a 
similar power turn-on indication was obtained by grounding either the plus or minus 
power supply. 

Six failures due to open buffer resistors were recorded in the primary and back- 
up electronics early in the program. It was discovered that the resistance wire in 
these resistors was affected by chemical or electrolytic corrosion. All the buffer 
resistors were replaced by a different type of resistor, and no other problems of 
this type were encountered . The other component failures listed were caused by an 
intermittently functioning capacitor, a failed zener diode, and an open transistor. 
None of these occurred in flight , and all were detected through normal testing pro- 
cedures. During the flight program there were 12 backup electronic comparator 
tripouts, but the redundancy level of the total system was not affected. Ground 
checkout indicated that there were no failed components. 

The secondary actuator discrepancies consisted of component failures , problems 
related to differential pressure, and differential pressure comparator tripouts. With 
25 servovalves, 20 engage solenoids, and 20 differential pressure transducers in the 
airplane , occasional problems were expected . The servovalve was the only second- 
ary actuator component to fail . Three such failures occurred in the aircraft system . 
They were detected during ground tests and repaired . If such a failure had occurred 
in flight it would have caused the loss of one of the four actuator channels . 

As the table shows , the largest number of discrepancies occurred in the second- 
ary actuator differential pressure network. Four aborted takeoffs were charged 
against the differential pressure network, as well as four in-flight and 26 preflight 
differential pressure comparator tripouts. Most of these discrepancies were classi- 
fied as nuisance tripouts and occurred during control cycles whenever the primary 
system was engaged. All comparator tripouts were resettable by the pilot, and the 
total system's redundancy was not affected. Generally speaking, most of the differ- 
ential pressure problems experienced were caused by a tracking error between the 
various differential pressure signals , which caused the servo comparators to trip . 
This frequently occurred at the maximum travel of the actuator, where the differen- 
tial pressure signals were the highest . These nuisance tripouts were caused by a 


55 



combination of the various components' tolerances and valve nulls, and were pre- 
dictable for certain stick motions. The problem could be resolved by adding nulling 
capability to the servo loop to balance the various differential pressure signals. 

Another problem associated with the differential pressure monitoring system 
was the inability to detect some of the open failures. Unless the ram was stationary, 
it was difficult to develop the differential pressure necessary to disengage the 
faulty servo channel. As a result, a latent channel failure could occur in flight in 
the backup control system and not be indicated to the pilot . However , no such fail- 
ures occurred during the program . 

Six discrepancies were attributed to system wiring and aircraft power distri- 
bution. Four involved, respectively, a pin that was pushed back in a connector, 
a short-circuited cable clamp, a defective latching relay, and a faulty battery capac- 
ity meter . The faulty items were identified and repaired during the regular air- 
plane preflight. Two flights were aborted because of aircraft power problems. One 
was due to a checklist error that allowed the flight control system generator to re- 
main off, causing a low -voltage shutdown of the computer, and the other was due to 
a main generator failure. All those discrepancies were considered to be typical air- 
plane operating problems and not unique to fly-by-wire control systems . 

Four discrepancies that affected or would have affected the digital fly-by-wire 
system occurred in the aircraft hydraulics systems , and all required repair action . 
Hydraulic leaks that caused two flights to be cancelled were detected in the second- 
ary actuators. During one flight, hydraulic oil was seen streaming along the out- 
side of the airplane, and as a precautionary measure the flight was terminated and 
the airplane returned for a normal landing. During another flight, a hydraulic line 
ruptured, causing a loss of hydraulic pressure to backup channels 2 and 4. The 
hydraulic line was part of the basic F-8C hydraulic system that was not modified for 
the program. The loss of hydraulic pressure was detected by the pilot from the 
conventional F-8C hydraulic pressure gages and warning lights. The pilot terminated 
the flight and landed the airplane with the primary control system. Hydraulic line 
failures are rare but serious for flight control systems that depend on irreversible 
hydraulic actuators, such as those being used in all high-performance fighter and 
bomber aircraft and many new transport aircraft . Protection against hydraulic 
system failure is provided by using dual or triple hydraulic systems . Experience 
with aircraft that use irreversible actuators has shown the protection provided by 
this practice to be adequate. 

As the table shows , similar operating problems were experienced with the iron 
bird control system. All the simulation systems were flight qualified and could be 
flown on the airplane except the mechanizations of the primary and backup elec- 
tronics, which were not maintained with flight system quality control. The experi- 
ence obtained during the almost 2500 hours of operating time on the iron bird and 
the F-8 digital fly-by-wire airplane is indicative of what could be expected of a 
similar period on the aircraft system . 

Although many component discrepancies occurred during the program , they 
were detected by the monitoring system and testing procedures, and the reliability 
of the total system was maintained throughout the program . 
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CONCLUDING REMARKS 


A digital fly-by-wire control system with a triplex analog backup control sys- 
tem was flight tested in an F-8C airplane. Six pilots logged 58 flight hours during 
42 flights . The backup control system operated well in conjunction with the digital 
primary system and provided satisfactory handling qualities throughout the flight 
envelope evaluated . This experience showed that a dissimilar control system can 
be made to synchronize with the primary flight control system and provide satis- 
factory control during normal flight maneuvers. 

A limited flight test program was flown to evaluate airplane handling qualities 
with a force side stick controller through the backup control system. Even though 
side stick force gradients were not optimized , the control of the airplane in a variety 
of control tasks, including takeoff, landing, and formation flight, was satisfactory. 

The operational reliability of the digital fly-by -wire system , both primary and 
backup, was excellent. There were no downmodes from the digital primary con- 
trol system to the backup control system in flight due to real or apparent system 
failures. Several component discrepancies occurred within the redundant system, 
but they did hot affect the reliability of the total system . Most of the discrepancies 
were in the secondary actuator differential pressure network and were nuisance 
tripouts (capable of being reset) within the backup control system during large 
control inputs to the digital primary control system . 
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TABLE 1.- F-8 DIGITAL FLY-BY-WIRE CONTROL SYSTEM DISCREPANCIES 
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Flight terminated. 

System redundancy reduced to two channels on 
one flight . 




Figure 1 . F-8 digital fly -by -wire control system . 
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F-8 digital fly-by-wire backup control system - wing up 
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Figure 7 . Typical primary control system channel . 
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Side stick block diagram. 
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Figure 9. Hydraulics of secondary actuator with primary channel 
in control and channels 2, 3, and 4 in standby configuration. 
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Figure 11. Comparison of elevator secondary actuator frequency 
response controlled with backup control system valves . 
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